---
id: pkginfo2
version: "30.1.0"
license: MIT
license_treatment: permissive
maintenance: aging
---

# pkginfo2 — Query metadata from sdists / bdists / installed packages. Safer fork of pkginfo to avoid doing arbitrary imports and eval.

License: permissive · Maintenance: aging · Downloads: 130.7K/mo

## What it is and what it does

pkginfo2 is a metadata extraction library that safely reads package information from Python distributions—sdists, wheels, egg-info directories, and dist-info folders—without importing or executing code. It parses the PKG-INFO file and related metadata structures to expose distutils metadata fields as a queryable API.

The package is a fork of the original pkginfo that removes the ability to import and evaluate arbitrary code, making it safer for tools that need to inspect package metadata without triggering side effects. It targets modern Python versions and is intended for build tools, package managers, and metadata inspection utilities that need reliable, code-free access to distribution metadata.

Use it for:

- Build tools and package managers that need to inspect package metadata before installation.
- Dependency analyzers that extract metadata from sdists or wheels without executing setup code.
- Package indexing systems that parse PKG-INFO from distributions in a controlled, safe manner.
- Development tools that query installed package metadata from dist-info or egg-info directories.
- CI/CD pipelines that validate package metadata without importing or running package code.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

pkginfo2 reads and parses package metadata from source distributions, wheels, and installed packages without executing arbitrary code.

Yes, if you need safe, code-free package metadata extraction. Low install friction, no runtime dependencies, and a permissive license make it straightforward to adopt. The aging maintenance status is a minor concern but not a blocker for a stable, focused utility. Not necessary if you only work with installed packages via other metadata tools.

## Install

pip install pkginfo2
uv add pkginfo2
poetry add pkginfo2

## Installing pkginfo2

Before you install: Low install friction with no runtime dependencies. Maintenance status is aging—last release was 291 days ago, though the repository remains active and marked Production/Stable.

License in practice: MIT license permits commercial and private use with minimal restrictions; suitable for most projects.

Quickstart:

pip install pkginfo2

from pkginfo2 import get_metadata
metadata = get_metadata('path/to/distribution')

Requires Python 3.10 or later.

Verify before relying:

- Whether this package is actively maintained or in maintenance-only mode beyond the aging signal.
- Real-world usage patterns and whether 130690 monthly downloads reflect active adoption or legacy dependency chains.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 130.7K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

read package metadata, query sdist metadata, wheel metadata parser, PKG-INFO reader, installed package metadata, distribution metadata extraction, safe metadata inspection, metadata-extraction, safe-inspection

[View on SkillFed](https://skillfed.io/packages/pkginfo2) · [View on PyPI](https://pypi.org/project/pkginfo2/)