meaning of wildchar **/.* in package.json

** matches any file or folder in an arbitrary sub-directory. Note that * just matches files and folders in the root directory.

**/.* matches any file beginning with a '.' (usually hidden files, like the .git folder) in an arbitrary sub-directory.

**/*.@(jpg|jpeg|gif|png) matches any file in an arbitrary sub-directory that ends with a '.' and exactly one of either 'jpg', 'jpeg', 'gif', or 'png'.

source: https://firebase.google.com/docs/hosting/full-config#section-glob

That would mean "any files preceded by . in their name, which are located inside all child directories".

Not exclusive to package.json, but rather standard wildcard notation. Meaning depends which key this value was assigned to.