There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do they use a sophisticated script (like anti-virus checkers probably use) to parse the code to check for cleanness?
we don't apply any checks, since we know of no published "automatic" checks we could apply. most things submitted nowadays are simply too big for a visual check (such as i used to apply in the '90s when i first worked on ctan).
one hopes that people won't run anything with "standard" overwriting controls disabled, and we can't, of course, say anything about "unprotected" behaviour of packages (or anything else, for that matter).
in short caveat emptor...