Have a look at Term::ReadKey.

Cheers,

JohnGG

Update: Looks like I may have misunderstood the question. I thought the requirement was to stop the password being echoed, not to hide it in the script. To do that (in a *nix environment) I'd place the password in a file owned by the process with rwx------ permissions under a directory with the same ownership and permissions so others couldn't browse, then read the file in the script.