The version was released 22 days ago. npm has a list of dependents https://www.npmjs.com/browse/depended/event-source-polyfill.

Gatsby is the big one, and it doesn't use a lockfile or pin the specific version so any new installation will receive the bad version, but this package is to only be used in development environment https://github.com/gatsbyjs/gatsby/blob/441a5af8e665256c7703....