I was on holiday in Mexico and used a dodgy ATM which skimmed my card. First I knew about it was my bank calling me to query some suspect transactions. I cancelled the card on the spot obviously.
A few weeks later, after I was home a transaction showed up on my account for the purchase of a whole heap of bedroom furniture. It took months for me to get the money back from the bank as the merchant had signatures (nothing like mine obviously) from the purchase which was made in a brick and mortar store with a (cloned) physical card. Nightmare!
I would have rejected the package if home when delivered. Otherwise return to delivery company, wipe your hands of it. The last thing you want to do is open it as it amounts to accepting the goods, whereupon the seller may not accept its return.
Good luck!
