Replace each captured char to *?

You could use the callback argument of replace:

let h = "john.smith@gmail.com".replace(/(.)(.*)@/, (_, first, rest) =>
    first + "*".repeat(rest.length) + "@"
); 

console.log(h);

A global flag is what you are missing in your Regex.

I got this oneshot Regex that does the job:

"john.smith@gmail.com".replace(/(?!^)(?=.+@)./g,'*')

• Negative look ahead to exclude the first char.
• Positive look ahead for all chars preceding the @ char.
• Global flag to replace all captures.

let h = "john.smith@gmail.com".replace(/(?!^)(?=.+@)./g,'*');

console.log(h);

You can pass a replacement function in String.prototype.replace, e.g:

const result = 'john.smith@gmail.com'.replace(
    /^(.)(.*)(@.+)$/,
    (match, ...groups) => groups[0] + '*'.repeat(groups[1].length) + groups[2]
);
     
console.log(result);

Your regex will match the whole part and replace that with a star. Instead you want the regex to be able to match every char that you want to match separately. This will work:

let h="john.smith@gmail.com".replace(/(?<=^.+)(?<!@.*)[^@]/g,'*') 
    
console.log(h);

To break the regex down:

(?<=^.+) will match the start of the string, the first character and any number of characters after it using a positive lookbehind. That concept will work to match the string but not be included in the resulting match.

(?<!@.*) is a negative lookbehind to make sure we don't match anything after the @ symbol.

[^@] matches any character that is not @.

g at the end means global, that makes it match any number of times instead of only once.

Just writing:

let e = Array.from("john.smith@gmail.com").reduce((arr, char, index) => arr.concat(arr.includes('@') || char === '@' ? char : index === 0 ? char : '*'), []).join('');

console.log(e)

A simple regex replacement will do:

let h="john.smith@gmail.com".replace(/(?!^).(?=.*@)/g, '*') 
console.log(h);

Details

• (?!^) - not the start of the string
• . - any char but a line break char
• (?=.*@) - immediately to the right, there must be 0+ chars other than line break chars and then a @.

See the online regex demo.