The npm package 'pkg-with-optional' version 1.0.0 has been identified as containing malicious code. The package is flagged due to its communication with a domain linked to malicious activity. This behavior classifies the package as malware within the npm ecosystem.