A package you didn’t order could be a fun surprise, but be careful — especially if it comes with a QR code. It might be the setup for a scam.