Sweet. Looks like it should work then. The only problem is that private npm repos use a @namespace/package format. I don't think :@namespace/package would be valid. Looks like you support strings for requires. Do you also support strings for :npm-deps?
strings in `:npm-deps` should just work. I'm more concerned about the npm syntax for `@namespace/package@version` which I'm not sure is valid. If it doesn't work though, please open a ticket so we can fix it!