If your colleague executes the package from SSDT or BIDS, it will automatically save before executing.

Also, if you are using source control, it might be causing a check-out when the package is opened. I wouldn't think a source control check-out alone would cause a package to be arbitrarily saved to disk, but it's worth checking into.