Received random LEGO from a stranger in Cannes… what the actual fork is going on?

I live in the US and received this package today covered with “FRAGILE” and seemingly legit customs forms indicating the sender is in France. Also on the forms is the word “LEGO”, so of course I’m going to open it, strangers danger be damned. Inside are two shadow box/display frames with a minifig in each and a note saying “Love Yourself”. The only signature is the person’s “tag” printed on the back of the figs’ torsos. There’s a QR code which may lead me to the sender, or it may take over...