No I don't get it from what you posted.

One of my client site previously was infected with malware as well (as reported by Google Chrome when you try to access the site).

I found out a code was padded at the end of the index file as well as all .js file. I replaced those files & the malware keep coming back after awhile.

I then change the ftp password & update those files again. The malware no longer come back.

So I conclude it's a FTP password leak.

I don't think it's a trojaned FTP client but more like a trojan that read saved password from the popular FTP client.