Because we don\'t want sensitive data in the project code, including the package.json file, using environment variables would be a logical choice in my opinion.
Exam
No it isn't possible as npm does not treat any string values as any kind of templates.
It may be better to just use git+ssh (if your provider supports it) with an ssh agent.
git+ssh