You should start at template_preprocess_node()
where the $scripts
variable is initialised:
$variables['scripts'] = drupal_get_js();
Then have a look at drupal_get_js()
and follow the functions from there to find out how that mechanism works.
Then have a look at any implementations of hook_page_alter()
throughout your site, where the $vars['scripts']
variable might be being manipulated.
Even though that technically answers your question, I'd be surprised if you find what you're looking for there. I've never heard of any malware that specifically targets Drupal (which is what this would be if it's manipulating the $scripts
variable).
I'd check the rest of your page source to see if there's some JS being injected somewhere which is adding that <script>
tag to the <head>
dynamically, just in case.