Should app passwords in package.json be committed to git repository? Can it be avoided?

[harshit-j1]

I have a private npm module in Bitbucket. I am using that module in another private project which contains Firebase functions and to do so, I need to save app password with its repo URL in package.json.

"dependencies": {
    "my-module": "git+https://<username>:<app-password>@bitbucket.org/<owner>/<repo>.git"
}

It's normally recommended not to commit any credentials to git. But to access this private module, this app password needs to be committed in the url.

Is there any way it can be avoided?