Sweet. Looks like it should work then. The only problem is that private npm repos use a @namespace/package format. I don't think :@namespace/package would be valid. Looks like you support strings for requires. Do you also support strings for :npm-deps?
This is huge. Very excited for this! Is there support for private NPM repos? NPM looks for the registry URL and auth token in ~/.npmrc and uses that to authenticate.