hexo "updates itself" when testing locally

[jtimon]

While testing locally (npm install, npm start), package.json modified itself:

   "hexo": {
-    "version": "3.2.2"
+    "version": "3.3.8"
   },
   "dependencies": {
     "hexo": "^3.1.0",

Not sure what to do about that...
More data:

$ npm -v
3.5.2
$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04 LTS
Release:	16.04
Codename:	xenial