What I don't get is why the attackers didn't exchange at least some of USDC/USDT to ETH, looks like it took ~1hr for Circle/Tether to lock the wallet.

They did, I'm seeing 700 million but there is still movement going on

If any Vim/NeoVim users want to play with the language, I made Vim plugin for Goose:

Link: https://github.com/exaroth/goose-lang.vim

Installing any npm packages seems more and more like walking through the minefield at this point.

And the worst part is installing one pulls like 50 bazillion others because of how dysfunctional the ecosystem is