This isn't npm doing analytics. It's the package manager abusing a dependency declaration and a preinstall script to do their own private analytics.