I used flask a lot and love Armin, but, with all due respect, this is an overreaction. The world is on fire and pypi.org decided to throw 1 (one) bucket on it. There's no slippery slope lurking in the shadows, "The Index" is not some mythical beast with unknowable intent, it's mostly other overworked and underpaid open source developers. It will be fine.