Common questions about the TwiLite OSRS client, the twilite.dev marketplace, Jagex login, and the native mlp uploader inside twilite_loader.dll.
TwiLite is a closed-source Old School RuneScape client and plugin marketplace sold at twilite.dev. The Windows launcher twilite_loader.exe injects twilite_loader.dll into the Jagex OSRS client and loads twilite-bot.jar (TwiLite Native). It is not RuneLite.
No. TwiLite from twilite.dev injects twilite_loader.dll into the Jagex Old School RuneScape client. That DLL exposes plaintext password and TOTP, writes JX_ACCESS_TOKEN / JX_REFRESH_TOKEN, and can POST arbitrary files to a hardcoded Discord webhook.
twilite.dev is the official TwiLite website and plugin marketplace. Pages such as the homepage, docs, and download are login-walled. The Windows launcher is twilite_loader.exe.
Do not. Eternal Farm and similar docs point people to https://twilite.dev/download. That installer injects native code with account-secret access. See the TwiLite download warning.
The client has everything needed to steal a Jagex account without asking again: password, TOTP, and reusable access/refresh tokens, plus an off-box uploader. Users on r/RunescapeBotting reported compromised accounts after using TwiLite.
NativeBridge.mlp(byte[], String) starts a thread, attaches the bytes as mlp.bin, prefixes user: , and POSTs to discord.com. TwiLite staff called it a planned remote-control feature “to send data that users need… on demand.”
Yes. Native mixins bind getPassword and getTotp. getPassword reads a client field and returns it with JNI NewStringUTF. A TwiLite developer said the game exposes credentials in plaintext and they “simply read it with JNI so we can pass it to Java.”
No. RuneLite is the Jagex-approved open-source OSRS client. TwiLite is a closed-source injected client with a Discord marketplace, used as a native Windows launcher (including by farm panels).
TwiLite Native is the injected Windows stack: twilite_loader.exe + twilite_loader.dll + twilite-bot.jar, used with Jagex accounts. Farm-panel docs often send people to twilite.dev/download for that launcher.
TwiLite staff use a TL badge on Discord. A developer posting as Tyrese confirmed they read plaintext Jagex credentials over JNI, called the Reddit write-up “AI cope,” and said anyone who “fucks with me will not end up in a good spot.”
twilite_loader.dll.