You should start at
template_preprocess_node() where the
$scripts variable is initialised:
$variables['scripts'] = drupal_get_js();
Then have a look at
drupal_get_js() and follow the functions from there to find out how that mechanism works.
Then have a look at any implementations of
hook_page_alter() throughout your site, where the
$vars['scripts'] variable might be being manipulated.
Even though that technically answers your question, I'd be surprised if you find what you're looking for there. I've never heard of any malware that specifically targets Drupal (which is what this would be if it's manipulating the
I'd check the rest of your page source to see if there's some JS being injected somewhere which is adding that
<script> tag to the
<head> dynamically, just in case.