Because we don\'t want sensitive data in the project code, including the package.json file, using environment variables would be a logical choice in my opinion.
Exam
No, it's not possible. You should access the repo using git+ssh, and store a private key in ~/.ssh.
git+ssh
~/.ssh
Your line then looks like:
"my-private-module":"git+ssh://git@bitbucket.org/foo/bar.git"
Which doesn't contain anything sensitive.