A friend and I pulled a similar stunt on a co-worker some time back.
After a long series of joke-perpetrating back and forth, we procured
a rather large box and filled it with packing 'peanuts', then proceeded
to cut a large hole in the bottom and invert the box on the victim's
desk. We then took a short length of string and fed it into a tiny hole
in the top of the box, taping the other end to the side of the box.
This 'red herring' was easily mistaken for some type of trip-wire to
be engaged if the box was opened. When the victim saw the parcel, he
immediately knew the source and, wary of opening the box, followed his
initial instincts and quickly grabbed it to move it off his desk ...
the rest is fairly obvious ...