pkginfo2

Query metadata from sdists / bdists / installed packages. Safer fork of pkginfo to avoid doing arbitrary imports and eval.

pkginfo2 v30.1.0 130.7K downloads/30d#11,631 on PyPI★ 3

Permissive license MIT AGING released 2025-10-27

What it is and what it does

pkginfo2 is a metadata extraction library that safely reads package information from Python distributions—sdists, wheels, egg-info directories, and dist-info folders—without importing or executing code. It parses the PKG-INFO file and related metadata structures to expose distutils metadata fields as a queryable API.

The package is a fork of the original pkginfo that removes the ability to import and evaluate arbitrary code, making it safer for tools that need to inspect package metadata without triggering side effects. It targets modern Python versions and is intended for build tools, package managers, and metadata inspection utilities that need reliable, code-free access to distribution metadata.

Use it for:

Build tools and package managers that need to inspect package metadata before installation.
Dependency analyzers that extract metadata from sdists or wheels without executing setup code.
Package indexing systems that parse PKG-INFO from distributions in a controlled, safe manner.
Development tools that query installed package metadata from dist-info or egg-info directories.
CI/CD pipelines that validate package metadata without importing or running package code.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

pkginfo2 reads and parses package metadata from source distributions, wheels, and installed packages without executing arbitrary code.

Yes, if you need safe, code-free package metadata extraction. Low install friction, no runtime dependencies, and a permissive license make it straightforward to adopt. The aging maintenance status is a minor concern but not a blocker for a stable, focused utility. Not necessary if you only work with installed packages via other metadata tools.

Install

pkginfo2 on PyPI

pip

pip install pkginfo2

uv

uv add pkginfo2

poetry

poetry add pkginfo2

Installing pkginfo2

Before you install

Low install friction with no runtime dependencies. Maintenance status is aging—last release was 291 days ago, though the repository remains active and marked Production/Stable.

License in practice

MIT license permits commercial and private use with minimal restrictions; suitable for most projects.

Quickstart

pip install pkginfo2

from pkginfo2 import get_metadata
metadata = get_metadata('path/to/distribution')

Requires Python 3.10 or later.

Verify before relying

Whether this package is actively maintained or in maintenance-only mode beyond the aging signal.
Real-world usage patterns and whether 130690 monthly downloads reflect active adoption or legacy dependency chains.

Package facts

License	MIT (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	aging — 291 days since the last release
Last repo commit	2025-10-27
First released	2022-01-27
Downloads	130,690/month — #11,631 on PyPI (30-day window, as of 2026-08-14)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-14)

Evidence: pkginfo2-30.1.0-py3-none-any.whl

Keywords: distribution, sdist, installed, metadata

Development Status :: 5 - Production/StableIntended Audience :: DevelopersOperating System :: OS IndependentProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Software DevelopmentTopic :: Software Development :: Libraries :: Python ModulesTopic :: System :: Software DistributionTopic :: Utilities