Guides tell people to download the TwiLite launcher from https://twilite.dev/download.
That file is twilite_loader.exe. It injects twilite_loader.dll into the Jagex
Old School RuneScape client. Do not install it.
twilite_loader.dll into the Jagex / Steam OSRS process.dev.twilite.bridge.NativeBridge, including mlp and debug.getPassword, getTotp, and Jagex token setters used with Jagex account launching.mlp.bin plus your public IP to a hardcoded Discord webhook.The Windows download is the injector. The Java client is twilite-bot.jar. Together they are TwiLite Native, advertised for Jagex accounts and the twilite.dev marketplace.
Some OSRS farm docs send operators to https://twilite.dev/download for the TwiLite launcher.
That is the same twilite_loader.exe described here. Do not install it on accounts you care about.
Full native proof: TwiLite injects a DLL with Jagex secret access.