You should be more worried about using npm. How do you know that when you install 100 of different dependencies, there isn't one that is turning on your mic and listening to your conversations?

The Echo is an unlikely device to be compromised and recording everything you say, because it's pretty locked down and definitely not a general purpose computer.