Source code files are plain text with opinions. The extension tells your editor what language it's looking at so it can colour the syntax and yell at you about semicolons. There's nothing special about a .py or .js file — it's a text file that a specific interpreter or compiler knows how to read.
The category spans everything from shell scripts (a few lines that automate a task) to full application source code (millions of lines across thousands of files). JavaScript runs in browsers. Python runs everywhere else. C and Rust run close to the metal. Java runs on the JVM. The file format is the least interesting part — it's the language, its ecosystem, and its tooling that matter.
Safety-wise, code files deserve respect. A .js, .py, or .sh file can execute arbitrary commands on your machine. Downloading and running code from untrusted sources is functionally identical to downloading and running an executable — the only difference is that you can read the source first. Whether you actually do is between you and your risk tolerance.
Batch files can execute any system command. Never run a .bat file from an untrusted source.
Source code file. Safe to read.
Source code file. Safe to read.
Dockerfiles can download and execute arbitrary software. Review before building.
Source code file. Safe to read.
Source code file. Safe to read.
Source code file. Safe to read.
HTML files can contain embedded scripts. Open files from unknown sources in a browser's sandbox, not as local files with full permissions.
Jupyter Notebooks can execute arbitrary code. Only open notebooks from trusted sources.
JavaScript files can execute code. Only run JS files from trusted sources.
Source code files can execute arbitrary code. Only run code from trusted sources.
Script file. Safe to read but can execute arbitrary code when run with a Lua interpreter.
Contains shell commands that execute when you run `make`. Review before running.
PHP files execute server-side code. Only run on trusted servers.
Script file. Safe to read but executes arbitrary code when run.
PowerShell scripts can execute any system command with elevated privileges. Never run from untrusted sources.
Python scripts can execute arbitrary code. Only run .py files from trusted sources.
Script file. Safe to read but executes arbitrary code when run with the R interpreter.
Script files can execute arbitrary code. Only run from trusted sources.
Source code file. Safe to read.
Shell scripts can execute any system command. Never run a .sh file from an untrusted source.
Source code file. Safe to read but executes when compiled and run.
Source code files can execute arbitrary code. Only run code from trusted sources.
Source code file. Safe to read but can execute arbitrary code when compiled and run.
Source code file. Safe to read but executes when built and served.
Source code file. Safe to read.