Heroku doesn't provide this out of the box, and
package.json doesn't natively support environment variables.
One option is to build your dependency as an NPM packages and publish it on a private package repository, e.g. Gemfury, whose Heroku addon has a free plan supporting a single private module.
Briefly, you can publish your module to Gemfury with
https://npm-proxy.fury.io/APPID/, followed by
npm login and
npm publish. Then, in the Heroku app that depends on your private module, add a
.npmrc file containing
and set a Heroku config var
FURY_AUTH containing your Gemfury auth token.
This does mean you'll have to update your published library on Gemfury before the dependent application will see changes you make to it. This is probably a good idea anyway; depending on specific tagged releases is safer than depending on mutable branches.
There is also this workaround which may let you effectively inject environment variables into your
package.json, but I haven't tried it.
To add to this answer
1) Create environment variables link.
2) Write environment variables into package.json file using a preinstall hook link.