ORA-01036: illegal variable name/number when running query through nodejs

[nitinsinghit]

I am running this simple query 'ALTER USER hr IDENTIFIED BY secret' using oracledb nodejs package. Not sure why I am getting illegal variable name error. Can I do something like this "ALTER USER :user IDENTIFIED BY :password";if yes then what will be correct syntax for me

function get(req, res, next) {
    oracledb.getConnection(
        config.database,
        function(err, connection){
            if (err) {
                return next(err);
            }

            connection.execute(
                'ALTER USER :userIDENTIFIED BY :password'+
                'where USER= :user'+
                'and password=:password'
            {
                email: req.body.user.toLowerCase()
            },
            {
                password: req.body.password.toLowerCase()
            },

                {
                    outFormat: oracledb.OBJECT
                }

          });
        }

Thanks for the help