Is there an official policy on what kind of code a package can have? I assumed it is the responsibilty of the end-user to determine if the package has code they

Is there an official policy on what kind of code a package can have? I assumed it is the responsibilty of the end-user to determine if the package has code they are willing to run. I mean the system worked just as intended: the user asked for a piece of code and PyPI delivered it.