Simulate ua-parser attack to assess dep-scan

[prabhu]

It is not clear if the risk audit feature of dep-scan caught the ua-parser.js attack. My guess is that it should've checked for the presence of the preinstall script and flagged this up. But will be nice to emulate and validate the feature.