I took your comment as saying the person who took the steroids can be lawfully detained, but if the person tells the authorities what was in the package than the OP gets in trouble as well.
This pertains to the OP: It would be hard to prove who took it since the package is god knows where and I doubt he used his own signature. Nonetheless, even if you find him he could report the package to the authorities and say its yours.