npm package report

Is event-source-polyfill safe?

Versions 1.0.25 and 1.0.26 of event-source-polyfill were compromised (environment variable exfiltration). Other versions are not flagged as malicious.

Do not install event-source-polyfill 1.0.25 or 1.0.26

HIGHanalyst verified

Environment variable exfiltration, verified by a CyberXYZ analyst.

// what we observed

event-source-polyfill npm account compromised Jan 2022. Malicious versions added code to exfiltrate environment variables and npm auth tokens.

year: 2022
mitre ttp: T1041

// versions and what to do

Malicious: 1.0.25, 1.0.26
Move to: 1.0.31 newest 1.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install event-source-polyfill@1.0.31

// reach

0 direct dependencies

none carry a known advisory

9 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:03 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.