Evidence (actually having a package delivered at this time and the app showing a message) points to this sms message being legit, but NOTHING ELSE ABOUT IT LOOKS ANYTHING BUT SUS.
Never send your users random messages to domains not associated with your brand and expect them to click it.
Most will, sure. But most are idiots.