This is in the latest published version 1.0.26 https://www.npmjs.com/package/event-source-polyfill
Gatsby is the big one, and it doesn't use a lockfile or pin the specific version so any new installation will receive the bad version, but this package is to only be used in development environment https://github.com/gatsbyjs/gatsby/blob/441a5af8e665256c7703....