"Revenge" is not a legal concept. If you injure someone other than in self defence or for another legal reason than you are committing assault. Hence dangerous booby traps for trespassers are illegal, so anything that might cause injury, however minor, is definitely out. That includes itching powder.
However I would make an analogy with anti-climb paint. This allows you to use a paint that damages clothing provided you put up warning signs. So if you were to leave a parcel coated with anti-climb paint or containing a bag of paint or glitter rigged to spill it over the person opening it then that would be legal as long as there was a warning that tampering may cause property damage.
(Note "spill", not "squirt" or "splash": anything ejecting paint or glitter under pressure might get it in someone's eyes, causing injury).
So your friend could put a notice up saying that unauthorised tampering with parcels could cause damage to property and then put out parcels that might do exactly that.
Your friend could also put a GPS tracker in a parcel to try to find out where they are going.
Update
Here is someone who did this. The BBC story does not mention any legal issues for him.
A former Nasa [sic] engineer spent six months building a glitter bomb trap to trick thieves after some parcels were stolen from his doorstep.
The device, hidden in an Apple Homepod box, used four smartphones, a circuit board and 1lb (453g) of glitter.
Mark Rober, who is now a Youtuber, caught the original thieves on his home security camera.
[...]
The former Nasa engineer said: "If anyone was going to make a revenge bait package and over-engineer the crap out of it, it was going to be me."