Malicious PyPI package soopsocks downloaded 2,653 times before takedown, exfiltrating Windows data to Discord.
os.path.join (folder, filename) ensures the path is correct for the system. On Windows, it uses backslashes (reports\summary.txt); on Linux and macOS it uses forward slashes (reports/summary.txt).