Online Resource 1: Client survey and selection record

Online Resource 1 to "Do Open-Source Video Ad Clients Follow VAST 4.3? An Empirical Study of Player Conformance" (Prashant Chaudhary, October 2026). Section 4.1 of the paper states the selection rule and the client set in summary. This document gives the full record behind it: the sixteen registry queries, the package counts at each step, the rule, the decision and reason for every candidate, the four eligible players that were not tested, the derivatives of vast-client-js, and the pattern in npm download counts that led the study not to use them. Paths are relative to the root of the replication repository. Each number is followed by the file it was copied from; a number marked "computed" was calculated for this document from the files named beside it.

1. What was surveyed and when

• Survey date: October 16, 2026 (results/survey/npm-sweep-2026-10-16.meta.json, field "date").
• Registry source: registry.npmjs.org search endpoint, size=250 per query (same file, field "registry"). Download counts: api.npmjs.org point/last-month (same file, field "downloads"), taken at survey time.
• Candidate data: results/survey/npm-candidates-2026-10-16.json (267 entries; per package: description, last release date, version, repository, last-month downloads). Metadata and dependency lists for the 25 plausible clients: results/survey/npm-metadata-2026-10-16.json (per package: version, license, repository, dependencies, number of versions, last release date, first release date).
• Second source of names: a catalog of DASH playback pathologies kept by the author (713 rows), used only as a list of client names; its findings belong to a separate study. The names in its "affected" field are almost all closed commercial players (THEOplayer, JW Player, Bitmovin, Brightcove plugins, Google IMA and IMA DAI, Roku RAF). The open-source names it holds are Shaka Player (already in the set), dash.js and Media3/ExoPlayer (no VAST handling of their own; Media3 ads go through the closed IMA extension), videojs-contrib-ads (an ad-state framework with no VAST parser) and videojs-ima (an IMA wrapper). It added Google IMA to the list and nothing else that parses VAST.
• Hand inspection: packages whose classification was not clear from their metadata were unpacked with npm pack (install scripts off) and searched for their own handling of VASTAdTagURI, TrackingEvents and [ERRORCODE], and for loading the IMA SDK. Ten packages were unpacked this way; their names were not kept.
• rmp-vast 17.2.0 was cloned from GitHub. The npm package of the same name stops at 6.0.0 (results/survey/npm-metadata-2026-10-16.json: version 6.0.0, last release 2022-06-24).

2. The sixteen queries

Source for every row: results/survey/npm-sweep-2026-10-16.meta.json, field "queries" (value = number of results the registry returned for that query). The request size was 250, so a value of 250 means the returned list was at the requested size; the files do not say whether more results existed.

Computed: the 16 values add up to 3,406 (13 queries at 250, plus 91, 52 and 13). Thirteen queries returned exactly the requested size. Only vmap, vpaid and simid returned fewer than 250, so only those three lists are known to be complete.

Filter applied to the pooled results (same file, field "filter"): a package is kept when its name, description or keywords match the regular expression \bvast\b|vmap|vpaid|simid|\bima\b. These are the five terms the paper names in Section 4.1 (VAST, VMAP, VPAID, SIMID, IMA).

3. Package counts at each step

Tally of the 25 packages in the metadata file by decision (computed; sections 5 and 6 below list every package):

The funnel is not strictly nested. Several packages with a decision are not among the 25: video-ad-sdk, iab-vast-loader and @dailymotion/vast-client were already in the set, and videojs-ima, videojs-ima-player, ima-ad-player, ima-wrapper, vast-xml, vast-builder, vastlint, @types/vast-client and react-native-vast-client are in the 267-package file but not in the 25-package file. Shaka Player is in neither file, because the npm queries did not return it. @ygoto3/omap-iab-client 0.0.6 is also in neither file (section 5, group G).

4. The selection rule

The four conditions are those of paper Section 4.1. A package is a client for this study when all four hold:

1. An OSI-approved license in the published package.
2. Its own VAST implementation, not a wrapper of vast-client-js, video-ad-sdk or the IMA SDK.
3. It does at least one of Wrapper resolution or tracking. A parser that does neither is out of scope.
4. A release on or after October 16, 2024 (24 months before the survey date).

Two further statements go with the rule:

• Wrappers of IMA are covered by testing IMA itself.
• Derivatives of vast-client-js are listed (section 7) so that a reader can judge the reach of findings that trace to vast-client-js; they are not tested.

Clients in the tested set that do not meet all four conditions, and why they are included:

• video-ad-sdk and iab-vast-loader were chosen before the survey as the established independent libraries. They fail condition 4 today (last releases 2024-04-22 and 2021-02-25 in results/survey/npm-candidates-2026-10-16.json). They are kept because they remain installed in players and their behavior is what those players do (paper Section 4.1).
• rmp-vast 17.2.0 imports VASTClient from @dailymotion/vast-client 6.4.2, which it bundles (rmp-vast src/js/index.js line 13 and package-lock.json at commit 5975ead). It therefore fails condition 2 for fetching, parsing and the Wrapper chain. It is kept as the production player built on vast-client-js, a real integration of that library (paper Section 4.1). The bundling does not show in package metadata or in a search for package names, because a bundled dependency carries no package name in the built file; it shows in the source import and the lockfile. Each of the other new candidates was searched for vast-client-js signatures (nextWrapperURL, VAST-warning, VASTClient), and none carries them.
• Google IMA is proprietary and fails condition 1. It is kept as a closed comparison and was pinned by archiving the served ima3.js with its sha256 (Online Resource 4).
• Shaka Player was not selected through the four conditions. It was added by hand because it is a widely used media player with its own VAST parser that the npm queries did not return under these keywords (paper Section 4.1).

Every tested client is reported in the paper.

5. Every candidate, its decision and its reason

Columns: version, last release and last-month downloads are copied from results/survey/npm-candidates-2026-10-16.json; license is copied from results/survey/npm-metadata-2026-10-16.json where the package is in that file. Group I lists the packages in the metadata file that were not assigned a decision, with only the facts in the data files.

A. In the client set before the survey (4)

B. New, tested (3)

C. New, pass the rule, not tested (4)

D. Excluded: wrappers of the IMA SDK (condition 2)

E. Excluded: derivatives of vast-client-js (condition 2; listed in section 7)

F. Excluded: closed or unlicensed (condition 1)

G. Excluded: parser only, or no release in 24 months (conditions 3 and 4)

H. Excluded: not clients

I. In the 25-package metadata file, not assigned a decision

Outside the JavaScript harness: native SDKs (the Media3 IMA extension, Kaltura native, Roku RAF) and Go or Python struct libraries, which neither resolve Wrappers nor track. A Go parser, haxqer/vast, is excluded because it is a data-binding library with no player duties to test.

6. The four eligible players that were not tested

Source: section 5, group C; paper Sections 4.1 and 7. They pass the four conditions: they are recent small players with embedded VAST engines.

Why they were not tested: they embed VAST code in a larger player instead of offering it as a library (paper Section 4.1), and testing them is left to future work. The harness has no adapter for any of them: code/harness/adapters/ holds env, fakevideo, iabloader, normalize, run, vastclient, vastlint and videoadsdk, and code/harness/browser/ holds the browser entry points and adapters for the tested clients only. Whether the results generalize to these four players is not known (paper Section 7, External validity).

7. Derivatives of vast-client-js

Dependency facts come from results/survey/npm-metadata-2026-10-16.json, and repository facts for react-native-vast-client from results/survey/npm-candidates-2026-10-16.json.

In addition, rmp-vast 17.2.0 bundles vast-client-js 6.4.2 and is tested (section 4). None of the six derivatives was run, so whether each inherits the timeout defect of vast-client-js (paper Section 5.1.3) is not tested. The version history in paper Section 5.4 shows that vast-client-js 5.0.0 does not crash, that 6.0.0 to 6.0.2 fail every plain Node.js request on an undefined window, and that 6.1.0 to 6.5.0 crash. A derivative that forks an old release or depends on the old vast-client package may therefore not be affected. The paper (Section 7, External validity) states that findings that trace to vast-client-js apply to players that bundle an affected release, and lists the derivatives as not tested.

8. npm download counts

What the paper says (Section 4.1, Sampling): download counts were not used to select clients, because three small packages in the survey show nearly equal monthly counts (about 23,000 each) that look like a mirror or an automated client.

The three packages (results/survey/npm-candidates-2026-10-16.json, last-month downloads at survey time; versions and first release from the metadata file):

Computed from the table: the three figures lie within 294 downloads of each other (23,336 minus 23,042), about 1.3 percent. Two of the three come from one author (repository ygoto3/omap). No other package in the 267-package file has a count between 22,000 and 24,500.

Reading of the pattern: two of the packages have had no release for more than 30 months (last releases 2024-03-28 and 2023-12-13, against a survey date of 2026-10-16) and still report about 23,000 downloads a month, and ts-video-player is under four months old. This is consistent with a mirror or automated downloads, but that explanation was not tested.

How counts are used: not as a selection criterion. A separate context file, results/survey/npm-downloads-2026-09.json (retrieved 2026-10-09 from api.npmjs.org, September 2026), holds the counts shaka-player 1,562,574; @dailymotion/vast-client 237,487; iab-vast-parser 12,554; video-ad-sdk 388; iab-vast-loader 224. The paper's introduction uses the first two (about 1.6 million and about 237,000) as context for how widely the libraries are used.