We are facing the same issue as described here https://station.railway.com/questions/what-is-the-best-way-to-install-private-8a84371c

Right now we have to create custom docker files for each of our node service that is using private npm pacakges. Besides that, there is no safe way of passing private npm token, so it gets logged with each build.