Was it a physical form like this? If yes, and you were expecting a USPS delivery, then it's real. No idea though why the carrier would have tucked it into a newspaper. They usually stick or tape them to your front door. Though they sometimes just put them into the mailbox along with the rest of whatever they delivered that day.
No, you don't need a security app. A QR Code can't do anything but lead you to a site, or whatever it does. Some just translate to text.
If you want to check, call the USPS number right on the form. Per the page I linked to, it's 800-ASK-USPS (800-275-8777). I also double checked. It is the legitimate number for the USPS.