os.path.join (folder, filename) ensures the path is correct for the system. On Windows, it uses backslashes (reports\summary.txt); on Linux and macOS it uses forward slashes (reports/summary.txt).
Malicious PyPI package soopsocks downloaded 2,653 times before takedown, exfiltrating Windows data to Discord.
The attackers used process hollowing against RegAsm.exe, patched Windows defenses such as AMSI and ETW and unpacked further ...