const regex = /(?!^).(?!.{0,1}$)/gm;
const str = `someword`;
const subst = `*`;
const result = str.replace(regex, subst);
console.log('Substitution result: ', result);
str.replace(/(?<=.{2}).(?=.{2})/g, '*')
// или
str.replace(/^(.{2})(.+)(.{2})$/, (m, g1, g2, g3) => g1 + '*'.repeat(g2.length) + g3)
// или
Array.from(str, (n, i) => (i < 2 || i > str.length - 3) ? n : '*').join('')