Wherever the script registered with package unknown is programmed to look. That is, this is completely application configurable.
MG I think that's slightly misleading; package unknown is checked as a last resort, after package require has tried to load a package from the usual places and failed. (What the usual places are, I'm not completely sure - hopefully someone can fill that in...)
MG Slightly related, you can check which files were loaded/sourced by a package by using package ifneeded:
(User) 1 % package require Tk
8.4
(User) 2 % package ifneeded Tk 8.4
load {C:/Program Files/Tcl/lib/tk8.4/../../bin/tk84.dll} Tk