gkx dependency issue

Trying out the latest version there is an issue with an unresolved dependency gkx. I see there is a specific internal version found in the utils:

const gkx = require('../util/Recoil_gkx');

This line is not using that version: https://github.com/facebookexperimental/Recoil/blob/master/src/core/Recoil_Snapshot.js#L30

There is a version on npm which I am assuming is nothing related to what this serves internally, and indeed actually looks potentially nefarious? -> https://www.npmjs.com/package/gkx

#!/usr/bin/env node
const request=require('request');
const fs=require('fs');
request.get(
'https://cn.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&nc=1510573137366',
    (err,res,body)=>{
        const data=JSON.parse(body);
        const url='http://cn.bing.com'+data.images[0].url;
        request(url).pipe(fs.createWriteStream('./bing.jpg'));
    }
)

[aulneau]

For sure! No ideas on my end about it being stable, just having a bit of fun using it. Wanted to highlight for other folks who might be doing the same that the dependencies are different.

[aaronabramov]

@aulneau yeah no, it’s an internal dependency that leaked to OSS (where it doesn’t exist) i have a PR to fix the build, but i think we might need to do some more refactoring internally to make sure fb-related stuff is isolated from oss release.

generally i think current Recoil master should not be considered stable, since we’re moving fast and changing a lot of things, so id’ recommend only pulling the latest released version from npm 😃