The offending event-source-polyfill version is still on npmjs.com.