hexo "updates itself" when testing locally

While testing locally (npm install, npm start), package.json modified itself:
```diff
"hexo": {
- "version": "3.2.2"
+ "version": "3.3.8"
},
"dependencies": {
"hexo": "^3.1.0",
```
Not sure what to do about that...
More data:
```
$ npm -v
3.5.2
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04 LTS
Release: 16.04
Codename: xenial
```

Reproduce the behavior with npm install and npm start, using the reported npm 3.5.2 and Ubuntu 16.04 environment. Compare package.json before and after, focusing on the hexo version and dependency declaration; done means establishing why the file changes and defining a reproducible fix that prevents unintended modification.

索引モデルが issue の本文から書いたものです。