There are multiple ways to do it as people point out, but the shortest versions are:
// from master
"depName": "user/repo",
// specific branch
"depName": "user/repo#branch",
// specific commit
"depName": "user/repo#commit",
// private repo
"depName": "git+https://[TOKEN]:[email protected]/user/repo.git"
e.g.
"dependencies" : {
"hexo-renderer-marked": "amejiarosario/dsa.jsd#book",
"hexo-renderer-marked": "amejiarosario/dsa.js#8ea61ce",
"hexo-renderer-marked": "amejiarosario/dsa.js",
}